GHSA-2FF2-MX52-Q8WP October CMS: PHP Object Injection via Backend Widget Session Storage

The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the widg...

Deserialization of Untrusted Data

Overview october/system is a System module for October CMS. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the SessionMaker process. An attacker can execute arbitrary PHP code by injecting a crafted serialized payload into the widget. session key, which i...

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

On August 21 and August 22, 2026, Wordfence Argus, created by the Wordfence Threat Intelligence team, identified two independent critical vulnerability chains in The Events Calendar, a WordPress plugin active on more than 600,000 websites. Both chains begin in the plugin's widget-rendering pipeli...

Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, as well as the AdminURLFieldWidget widget, are susceptible to a potential denial-of-service attack due to certain inputs containing a very large number of Unicode characters...

WordPress BE REST Endpoints plugin <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation vulnerability

Unauthenticated Stored XSS and Widget Manipulation vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin BE REST Endpoints versions = 1.0.0...

Malicious code in hotels-widget (npm)

Source: ossf-package-analysis bc89d8c1cd178341947d46f998ed1e1915c4d6d5aa787e8e939b51ed463de409 The OpenSSF Package Analysis project identified 'hotels-widget' @ 99.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...

Malicious code in hope-widget-xyz (npm)

The package hope-widget-xyz was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in goals-summary-widget (npm)

The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...

CVE-2026-78159

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

EUVD-2026-76833

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

CVE-2026-78159 The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the issafewidgetinstance function. This is due to insufficient protection in issafewidgetinstance, which can be bypassed because PHP fires magic methods during its...

CVE-2026-78159

The Events Calendar plugin for WordPress (stellarwp) is vulnerable to unauthenticated Remote Code Execution in all versions up to and including 6.17.3 (CVSS 9.8 Critical, CWE-94). The root cause is insufficient validation of the widget 'classes' map , allowing a plain-array payload to bypass the ...

CVE-2026-78159 The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

CVE-2026-81742 BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-81742

The BE REST Endpoints WordPress plugin, in versions through 1.0.0 , is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) and widget manipulation . The root cause is a failure to perform authorization checks before allowing widgets to be read, created, updated, or deleted, combined w...

CVE-2026-81742 BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

EUVD-2026-76786

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

EUVD-2026-76817

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

WordPress Custom Menu Wizard Widget plugin <= 3.3.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Custom Menu Wizard Widget versions = 3.3.1...